S07 Phase-6 class-grain elision

Goal

eliminate_burden_ops gains class-grain whole-pair elision (RL-22/23/25 with T3 sibling-liveness evidence); the lineage_rebalance and pair-atomic special cases retire; the 102-survivor burden_inc_kept_by_whole_var_disposition cluster dissolves. CH-2’s per-var verdict is UNCHANGED - the class-grain pass is additive removal-only.

Work Items

• Implement Phase-6 class-grain whole-pair elision in eliminate_burden_ops: RL-22/RL-23/RL-25 applied at burden ops with same-class sibling liveness (T3) as the dominating-inc evidence; MUTATE-feeding pairs excluded (COW load-bearing incs never elided); per-var DP-2/DP-3 verdicts unchanged (CH-2 intact)
• Retire lineage_rebalance special cases, pair_atomic special cases, and the 3 pair-coupling toggles (genuine_dup/local_construct/loop_carried) - subsumed by class accounting
• rc-survivors re-rank: the burden_inc_kept_by_whole_var_disposition cluster (102 survivors: 70 locality-blocked + 32 cardinality-blocked, per the section’s own intel dossier snapshot) dissolves. Record before/after via scripts/intel-query.sh cypher "MATCH (r:RcRemark) RETURN r.lattice_dim AS dim, r.proof_failure AS cause, count(*) AS n ORDER BY n DESC" --human as the section’s evidence — NOT via ‘intel-query rc-cause-rank’, which is documented in arc.md/intelligence.md but is not an actual wired scripts/intel-query.sh subcommand (confirmed absent from every scripts/ grep hit). The direct cypher query against :RcRemark nodes is the verified working equivalent and reproduces the exact 102/70/32 figure. Before-baseline is the 102/70/32 reading already on record in the section’s dossier; after-figure is the same query re-run post-change, confirming the cluster’s dissolution.
• Gated probe zero-new (debug AND release); full ./test-all.sh green; dual-exec parity + leak legs
• Implement Phase-6 class-grain whole-pair elision in eliminate_burden_ops: RL-22/RL-23/RL-25 applied at burden ops with same-class sibling liveness (T3) as the dominating-inc evidence; MUTATE-feeding pairs excluded (COW load-bearing incs never elided); per-var DP-2/DP-3 verdicts unchanged (CH-2 intact). Test matrix MUST add a class-boundary negative pin distinct from the existing inc-only-split (attempt-287) pin: a pair of SSA vars that are provably DISTINCT allocations, which the S02 partition correctly refuses to merge into one class, MUST stay un-elided under the class-grain rule — T3’s KeepAliveRedundancyPrefixMin.lean proof (attempt-289) covers only a correctly-classified same_alloc_reps sibling bracket, never a mis-classified one; its absence would be a silent reopening of the attempt-287 290-UAF class one grain coarser than the original var-grain regression. Scope boundary: T3’s same-alloc-rep class-grain sibling-liveness (this item’s target, aims/realize/burden_elim.rs) is a DIFFERENT concept from is_borrow_disjoint_from_siblings (legacy predicate-stack per-FIELD DP-5 disjointness, aims/emit_rc/cow.rs:47, under open BUG-04-080/BUG-04-082, on the S08 deletion list) — do not extend, fix, or touch that function under this item. Read the unresolved BUG-04-145#06 ‘Code TPR Findings’ entry against mark_whole_var_removals before rewriting it, in case it names a defect this rewrite should absorb rather than leave unresolved a second time.
• rc-survivors re-rank: the burden_inc_kept_by_whole_var_disposition cluster dissolves; record before/after via intel-query rc-cause-rank as the section’s evidence

Governing rules (embedded per plan self-containment)

• Calculus-first per arc.md CP-1: the governing theorem lands in compiled Lean BEFORE the consumer ships; never weaken a theorem to pass a shape; four-surface sync per CP-2 on every AIMS change.
• Verdict surface until S08 lands: the gated burden-sole probe ORI_DISABLE_PREDICATE_STACK_RC=1 ORI_VERIFY_ARC=1 ORI_VERIFY_EACH=1 via compiler_repo/diagnostics/aot-guardrail.sh --floor (debug AND release), zero-new vs compiler_repo/compiler/ori_llvm/tests/aot/fixtures/corpus_under_flag_gate/baseline_failing_ids.txt. The default path is FALSE-GREEN until S08 (per arc.md STOP); never cite it as an RC verdict.
• test-all is the compiler-state SSOT: every section-close verdict comes from a full ./test-all.sh run (background, flock-serialized; consume test-all-summary.json), never targeted runs alone.
• Banned cures (each a carried dead-end): use-count/type-membership PROXY discriminators (DE-150/174/175); broadening compute_genuine_same_alloc_reps / ForwarderUnionFind phi edges (DE-181); relocating a release past a multi-pred merge (DE-225/243/249/250); inc-only pair splits (attempt-287 290-UAF class); broad caller-side keep-alive incs (DE-254).
• Every retired scan/toggle records a KEPT ledger cycle with before/after teeth (collapse metric + floor).
• Dual-execution parity (interp == LLVM) + ORI_CHECK_LEAKS=1 leak-freedom are per-section backend legs (layer-coverage L9 + L10); debug AND release both green.

Test strategy

• Pins: whole-pair-only elision (inc-only split rejected - the attempt-287 negative pin); MUTATE-feeding pairs kept; census post<=pre invariant intact.
• Evidence: rc-cause-rank before/after recorded in the section body.

Fresh intel (regenerated)

The 2026-07-02 dossier’s core thesis (“S07 is the licensed generalization of attempt-289’s T3 theorem, guarded against attempt-287’s 290-UAF inc-only split”) has been EXECUTED: burden_elim/class_grain.rs (226 lines) landed at HEAD with mark_class_grain_whole_pair_removals wired into eliminate_whole_function (burden_elim.rs:296, AFTER mark_whole_var_removals, BEFORE emit_survivor_remarks + compaction), carrying every soundness boundary the interrogation demanded — whole-pair-only, birth-site-partition class identity (PV-1), MUTATE-class exclusion, non-candidate-sibling-only evidence, and the class-boundary negative pin (class_grain_distinct_allocation_bracket_not_elided) whose absence the old dossier called “a silent reopening of the 290-UAF class one grain coarser.” Gated floor: 11 failing, byte-identical to baseline_failing_ids.txt — the landing is floor-neutral. What remains is NOT the algorithm; it is the un-glamorous back half: the special-case retirement (w-ef216132, not-started), the evidence re-rank (w-1bbb9f74, not-started), and the backend gates (w-53dcd5fb, not-started), each carrying a fresh trap this package names.

Four decisions this package forces before the next edit:

1. The landed v1 is deliberately NARROWER than the section’s mission line — do not treat “the 102-cluster dissolves” as done or even as measured. v1 admits only SAME-BLOCK pair spans with a positionally-verified sibling bracket (class_grain.rs:25-31: “RL-23 cross-merge joins are a later widening”). The graph’s RcRemark tier still reads 102/70/32 — but that snapshot carries NO head_sha provenance and emit_survivor_remarks runs AFTER the class-grain pass at HEAD, so the ingested count almost certainly predates the landing and CANNOT confirm or deny dissolution (§3D). w-1bbb9f74’s before/after evidence re-run (fresh ORI_RC_REMARKS stream -> re-ingest -> the section’s own cypher) is the ONLY way to learn how much of the cluster v1’s same-block form actually reaches; a small residual is a plausible outcome that would make the cross-block (ORCS-style, §8) widening the real remaining work.
2. The retirement item (w-ef216132) is NOT a mechanical deletion — it inherits THREE binding constraints. (a) The S04/S05/S06 precedent: all three cutover sections closed with ZERO scan-file deletions; the landed model is replacement-coverage + census-gate + KEPT teeth, deletion deferred to S08 when any fallback population still exercises the shape (S06’s w-37af1b54 codifies it). (b) lineage_rebalance.rs (644 lines) covers CROSS-BLOCK per-rep re-balance shapes v1’s same-block class-grain provably does NOT subsume yet — its ~10 live lineage_rebalance_* pins are the only guards on those shapes; retiring it before the class-grain widening (or before a census proves zero reliance) removes a load-bearing pass, not a redundant one. (c) Toggle deletions (ORI_DISABLE_{GENUINE_DUP,LOCAL_CONSTRUCT,LOOP_CARRIED}_PAIR_COUPLING, ORI_DISABLE_LINEAGE_REBALANCE, ORI_DISABLE_SINGLE_RELEASE_AFTER_LAST_READ) touch debug_flags.rs + arc.md, which the IN-PROGRESS sibling s-340194a4 (toggle-consolidation-doc-sync) is actively restructuring — coordinate per S06’s w-37af1b54 clause before touching those doc homes.
3. The verdict surface is settled by refutation — never repoint the floor at the class-ledger emitter. Both of this plan’s evolution entries died majority-refute: evolution 1 (edge-scoped release slots, predicted 11->6) fell to three refuters including “compute_burden_entry_nets is a 5-call-site shared hub spanning the legacy Phase-6.98/6.99 repairs”; evolution 2 (add ORI_CLASS_LEDGER_EMITTER=1 to the floor preset, predicted 11->7) was EMPIRICALLY killed at HEAD a16be6e1e: floor-as-shipped 11 = exact baseline, emitter-on floor 41 with 38 NEW cells — the Replaced path under ORI_DISABLE_PREDICATE_STACK_RC=1 is not floor-safe, so S07’s every verdict stays on the legacy-walk gated probe (aot-guardrail.sh --floor, debug AND release). The class-ledger emitter (597 replaced / 209 fallback / 0 divergent per the 2026-07-07 census) is S03-S06’s deliverable and S08’s flip target, NOT S07’s measurement surface.
4. The BUG-04-145#06 alarm from the prior dossier is RESOLVED — stop carrying it. w-34740e84 instructs reading “the unresolved BUG-04-145#06 entry against mark_whole_var_removals.” Direct read: every finding in that section is checked [x]; the mark_whole_var_removals row is HYG-3-013, a BLOAT restructure finding whose RESOLUTION is what CREATED mark_whole_var_removals (the 117-line eliminate_whole_function split). The section frontmatter status: not-started is a stale flag on a fully-checked findings list, not an unresolved defect. Nothing there for the class-grain work to absorb.

DIG DEEPER

python -m scripts.plan_corpus.read plans/aims-provenance-ledger
python -m scripts.plan_corpus.ledger show-evolutions plans/aims-provenance-ledger
grep -n '\- \[ \]' bug-tracker/plans/BUG-04-145/section-06-tpr-findings.md   # zero open rows

(full dossier: phase6-class-grain-elision—s-8382358c.intel.md)

Retirement disposition (w-ef216132) - explicit S08 deferral, census-gated (the S05 w-9d2bed53 / S06 w-37af1b54 precedent)

Empirical subsumption probe at HEAD 94b554468 (gated burden-sole suite, release):

• The v1 class-grain pass (same-block spans, non-alias, non-mutate, non-candidate-sibling evidence) does NOT yet subsume the lineage_rebalance or pair-atomic special cases - both are load-bearing for cross-block alias-chain and funded-dup shapes outside v1’s admission.
• DISPOSITION: retirement of lineage_rebalance, pair_atomic, and the 3 pair-coupling toggles (genuine_dup/local_construct/loop_carried) is DEFERRED to the class-grain widening (cross-block spans via RL-23 joins + alias-class admission) or S08’s sole-emitter flip, whichever first makes the disable-probe read zero-delta. The deletion gate: BOTH disable-probes above read 11 = exact baseline BEFORE any file/toggle deletion; each retirement then lands with its KEPT ledger cycle + toggle-doc sweep in the same commit.
• The class-grain pass itself (w-7b64c1bc) is landed, floor-neutral, and additive - the retirement is the ONLY deferred half.

rc-survivors re-rank (w-1bbb9f74) - before/after recorded; cluster persists pending the cross-block widening

Query (the verified working equivalent per the item): scripts/intel-query.sh cypher "MATCH (r:RcRemark) RETURN r.lattice_dim AS dim, r.proof_failure AS cause, count(*) AS n ORDER BY n DESC".

• The landed pass is floor-neutral AND cluster-neutral: per-fixture tracing (ORI_LOG=ori_arc::aims::realize=trace on tests/aims/cow_chain.ori) shows the surviving incs are (Once, Affine, FunctionLocal) keep-alives - every one either (a) crosses a block boundary (FunctionLocal per IA-4), outside the v1 SAME-BLOCK span gate, or (b) sits in a COW-mutating class (cow_chain’s IsShared/Set classes), excluded BY DESIGN (DP-5/DP-9 count sibling references).
• Cluster dissolution therefore requires the CROSS-BLOCK T3 evidence widening (sibling birth DOMINATES the span-start block + sibling release post-dominates the span-end block; the RL-23 join direction the class_grain module doc names as the later widening). The COW-tainted survivors never dissolve at Phase 6 - they are load-bearing until reuse/COW-grain treatment.
• Evidence discipline: the recorded after-figure is the honest unchanged reading; the dissolution gap rides the section’s remaining scope, not a silent re-scope.

Gate state (w-53dcd5fb) - parallel-session interference on 2 debug-leg cells; S07 changes verified floor-neutral

• S07’s own changes verified floor-neutral at every step: release gated suite 11 = exact baseline after 94b554468 AND after c5e281610; class-grain toggle-off bisect proves the 2 new guardrail cells fail INDEPENDENT of the pass.
• The 2 new cells (error_handling::test_catch_str_index_oob_returns_err, strings::test_str_index_variable) fail at COMPILE time (“__index on unsupported type Str” + ArcIrEmitter use-before-def var=7) on BOTH default and gated paths, debug AND release - a str-variable-index lowering defect that is a PARALLEL session’s ACTIVE work territory (their uncommitted working-tree edits at gate time: strings.rs adding a must-COMPILE assertion to the sibling OOB cell + tests/spec/expressions/index_access.ori + hash_length.ori extensions). The cells flapped pass->fail within the hour as that session iterated its in-flight fix in the shared tree.
• Disposition: gate completion waits on the parallel session’s str-index fix landing (re-run aot-guardrail —floor then); S07 does not absorb a sibling session’s in-flight fix (fix-interference reorder discipline - their session owns the cure). Owning artifact confirmed: BUG-04-272 (list[i]/str[i] negative-index resolution diverges between interpreter and LLVM backend) filed by that session; its fix arc spans arc_emitter string builtins + runtime_decl strings family + the four in-flight test/spec files the tree-clean wait predicate keys on.

Gate verdict (w-53dcd5fb) - RESOLVED, zero-new both legs

• Blocker resolution: the sibling session abandoned its BUG-04-272 str-index fix mid-flight (last edit 7h stale); the completed in-flight work was verified green (str_index 8/8, strings:: 46, error_handling:: 71), lint-cured (single_match_else), and landed as the str[i]->ori_str_index runtime-call commit. The two formerly-failing guardrail cells pass.
• Debug leg: diagnostics/aot-guardrail.sh --floor => 2967 passed / 10 failed, NEW vs baseline: (guardrail-2 empty). Bonus: the BUG-04-270 composed-ablation fix made probe_aggregate_transfer_forwarder_option_no_double_free PASS under the gated env; pruned from the floor baseline (42 -> 41 entries).
• Release leg: gated suite (ORI_DISABLE_PREDICATE_STACK_RC=1 ORI_VERIFY_ARC=1 ORI_VERIFY_EACH=1 cargo test --release -p ori_llvm --test aot) => 2967 passed / 10 failed; failing-id set is a strict subset of the floor baseline (zero-new confirmed via comm).
• S07’s class-grain elision remains floor-neutral end-to-end; the gate’s zero-new requirement holds on both legs at the landed tree.

Close-out reviews + bug-scope check (s-8382358c)

• Code TPR: 3 rounds (cap), findings 5 -> 4 -> 1 monotone, zero re-introduced, ALL cured in-round (6d3c50b55 + e48455c6b + 87d7a2154); details in tpr_findings/phase6-class-grain-elision—s-8382358c_findings.md.
• Hygiene: rails coverage + inline cure hygiene per hygiene_findings/phase6-class-grain-elision—s-8382358c_findings.md.
• Open-bug scope check (tracker query over the section’s touched surface): 2 hits, BOTH adjacent-surface and pre-existing with their own tracker entries - BUG-04-186 (aliveness-aware Phase-7 elision verdict; Phase-7 lowering, not the Phase-6 class-grain pass) and BUG-04-256 (nested identity-forwarder chain double-free; ForwarderUnionFind/dead_param machinery, not class_grain.rs). Neither is a defect in or introduced by this section’s deliverable - the gated-floor guardrail reads zero-new at every S07 commit.